Root & Reason

• 

• 

• 

• 

Inspiration

Security teams often face a flood of logs, alerts, and suspicious events coming from different systems. The difficult part is not simply detecting an unusual event—it is understanding what happened, connecting related activities, identifying the evidence that matters, and deciding what to investigate next.

We started building Root & Reason — AI Incident Investigator to address this challenge. We wanted to explore how AI could help make security investigations faster to understand without treating AI-generated conclusions as unquestionable facts.

Our vision is to turn scattered security signals into meaningful, evidence-backed investigations that help analysts focus on the incidents that deserve attention.

What it does

Root & Reason is an AI-assisted security investigation platform designed to help users move from raw security logs to structured incident reports.

Its core workflow includes:

• Log ingestion: Accept security log datasets in CSV and JSON formats.
• Threat detection: Identify suspicious patterns such as repeated failed logins and successful logins following repeated failures.
• Event correlation: Connect related events using attributes such as usernames, source IP addresses, hosts, and timestamps.
• Risk prioritization: Assign transparent risk scores based on detection rules and their supporting evidence.
• AI-assisted investigation: Use Google Gemini to explain the available evidence, summarize incident timelines, and suggest appropriate verification steps.
• Evidence-backed reporting: Present incident details, contributing rules, supporting events, and recommended next steps in a readable report.

Rather than allowing AI to invent findings, Root & Reason is designed to ground its explanations in records retrieved from the application. Deterministic detection and scoring remain separate from AI-generated explanations.

The goal is to make security investigations more understandable, traceable, and accessible.

How we built it

We selected a modern full-stack architecture that supports an interactive investigation experience and allows us to develop the project further.

Our technology stack includes Next.js 16, React, TypeScript, App Router, Tailwind CSS, shadcn/ui, and Lucide icons for the application interface. We use Supabase PostgreSQL for structured data storage and plan access controls around authentication and Row Level Security. Google Gemini, integrated through the official JavaScript SDK, provides AI-assisted investigation and report generation.

The backend is organized around REST API endpoints and modular security-processing logic. This separates log ingestion, normalization, detection, event correlation, risk scoring, and report generation so that each component can be tested independently.

For our Amazon Developer Hackathon journey, we are also incorporating Amazon Devices Builder Tools (ADBT) into our development workflow to explore its documentation, guided development capabilities, and AI-assisted tooling. Our chosen direction is a simulated conversational investigation experience in a web application, rather than claiming an integration with an actual Alexa+ service.

We are prioritizing a complete workflow using controlled synthetic security logs so that the investigation process can be demonstrated without access to confidential organizational data.

Challenges we ran into

One of our main challenges is balancing AI assistance with reliable cybersecurity analysis. An AI-generated explanation may sound convincing even when the available evidence is incomplete. To address this, our design separates deterministic detection and risk scoring from AI interpretation and emphasizes references to the original events.

Another challenge is connecting events that appear unrelated when viewed individually. Correlation requires careful handling of timestamps, identities, IP addresses, and time windows; overly broad rules can generate false positives, while overly strict rules can miss related activity.

We also have to make several components work together reliably: the Next.js interface, REST API, Supabase database, log-processing pipeline, and Gemini integration. Security considerations such as protecting API keys, isolating user data, validating uploaded files, and treating log contents as untrusted input are important throughout development.

Accomplishments that we're proud of

We are proud of shaping Root & Reason around a practical security operations problem rather than building an AI chatbot without a clear purpose.

Our key accomplishments are the architectural design of an integrated investigation workflow, the focus on explainable risk scoring, the emphasis on evidence-linked AI explanations, and the decision to keep the core detection process independent of the AI provider.

We are also approaching the project with reproducibility in mind: controlled datasets, explicit detection rules, testable components, and a demonstration that can show the reasoning behind an incident rather than presenting only a final severity label.

Our priority is to make each finding understandable and traceable to the evidence that supports it.

What we learned

This project has helped us think about AI as an assistant to a security analyst rather than a replacement for security reasoning.

We have learned the importance of separating data processing, detection, correlation, and AI-generated interpretation. Reliable investigations require validated inputs, explicit rules, careful authorization, structured outputs, and transparent handling of uncertainty.

We are also learning how to combine modern full-stack development with cybersecurity engineering, database security, and AI integration while keeping the application's actual capabilities distinguishable from its planned enhancements.

What's next for Root & Reason

As Root & Reason, our next goal is to turn the project into a reliable, fully demonstrated prototype and continue improving it through testing and feedback.

We plan to strengthen event correlation, expand detection coverage, evaluate false positives against labelled datasets, improve evidence verification, and measure the time required to investigate comparable scenarios manually and with Root & Reason.

Longer term, we want to explore additional log sources, configurable detection rules, anomaly detection, more comprehensive investigation context, and integrations that help analysts investigate incidents across different environments.

Our guiding principle remains simple: AI can help explain a security incident, but every important conclusion should be supported by evidence.

Built With

• amazon-devices-builder-tools-(adbt)
• google-gemini-api
• lucide-react
• next.js-16
• postgresql
• react
• rest-api
• shadcn/ui
• supabase
• tailwind-css
• typescript